Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 921–940 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

HighPublished 25 Dec 2025, 07:00 WIB

CVE-2025-66443

CVE-2025-66443

Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a temporary denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T00:00:00.000Z. Updated 2025-12-26T14:52:09.843Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Dec 2025, 21:52 WIB

Official record

HighPublished 25 Dec 2025, 06:05 WIB

CVE-2025-68922

CVE-2025-68922

OpenOps before 0.6.11 allows remote code execution in the Terraform block.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T23:05:18.982Z. Updated 2025-12-26T14:52:36.571Z.

CVSS7.4v3.1

Showing 921 to 940 of 5493.First page Next page

KEV

Not listed

EPSSPresent

Updated26 Dec 2025, 21:52 WIB

Official record

MedPublished 25 Dec 2025, 06:02 WIB

CVE-2025-15073

itsourcecode Online Frozen Foods Ordering System contact_us.php sql injection

A vulnerability was determined in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /contact_us.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T23:02:07.917Z. Updated 2026-02-24T06:04:08.971Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:04 WIB

Official record

HighPublished 25 Dec 2025, 04:47 WIB

CVE-2025-68920

CVE-2025-68920

C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.

Excerpt language: en.

Severity high: primary CNA CVSS 8.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T21:47:22.944Z. Updated 2025-12-24T22:43:13.676Z.

CVSS8.9v3.1KEVNot listedEPSSPresentUpdated25 Dec 2025, 05:43 WIB

Official record

MedPublished 25 Dec 2025, 04:01 WIB

CVE-2025-68919

CVE-2025-68919

Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessible by a principal/authority other than ETERNUS SF Admin, allows an attacker to potentially affect system confidentiality, integrity, and availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T21:01:44.380Z. Updated 2025-12-24T21:29:13.243Z.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated25 Dec 2025, 04:29 WIB

Official record

MedPublished 25 Dec 2025, 03:19 WIB

CVE-2025-68917

CVE-2025-68917

ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T20:19:25.402Z. Updated 2025-12-24T20:38:16.538Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:38 WIB

Official record

CritPublished 25 Dec 2025, 03:14 WIB

CVE-2025-8769

MegaSys Computer Technologies Telenium Online Web Application Improper Input Validation

Telenium Online Web Application is vulnerable due to a Perl script that is called to load the login page. Due to improper input validation, an attacker can inject arbitrary Perl code through a crafted HTTP request, leading to remote code execution on the server.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T20:14:20.035Z. Updated 2025-12-24T20:36:42.847Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:36 WIB

Official record

HighPublished 25 Dec 2025, 02:55 WIB

CVE-2025-3232

Mitsubishi Electric Europe smartRTU Missing Authentication for Critical Function

A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:55:43.172Z. Updated 2025-12-24T20:01:27.393Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:01 WIB

Official record

CritPublished 25 Dec 2025, 02:43 WIB

CVE-2025-68916

CVE-2025-68916

Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:43:25.350Z. Updated 2025-12-24T20:05:20.432Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:05 WIB

Official record

MedPublished 25 Dec 2025, 02:40 WIB

CVE-2025-68915

CVE-2025-68915

Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner_w.cgi XSS via a crafted banner.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:40:06.720Z. Updated 2025-12-24T20:04:37.368Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:04 WIB

Official record

MedPublished 25 Dec 2025, 02:37 WIB

CVE-2025-68914

CVE-2025-68914

Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINFAILEDTABLE table.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:37:14.535Z. Updated 2025-12-24T20:03:44.090Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:03 WIB

Official record

HighPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25258

LogicalDOC Enterprise 7.7.4 Multiple Post-Authentication Directory Traversal Vulnerabilities

LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:06.519Z. Updated 2026-03-05T12:02:20.761Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record

HighPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25257

LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation

LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command, ocr.Tesseract.path, and other system p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:06.119Z. Updated 2026-03-05T12:02:20.000Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record

HighPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25256

VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers to access arbitrary system files through unvalidated 'ID' parameters. Attackers can exploit multiple Perl scripts like downloadsys.pl to read sensitive files by manipulating directory path trave…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:05.689Z. Updated 2026-07-28T01:46:48.799Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

HighPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25255

VideoFlow Digital Video Protection DVP 2.10 Authenticated Remote Code Execution

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows attackers to execute system commands with root privileges. Attackers can exploit the vulnerability through a cross-site request forgery (CSRF) mechanism to gain unauthorized system access.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:05.284Z. Updated 2026-07-28T01:46:48.150Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

MedPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25254

KYOCERA Net Admin 3.4.0906 Cross-Site Request Forgery via User Administration

KYOCERA Net Admin 3.4.0906 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft malicious web pages that automatically submit forms to add new admin accounts with predefined credentials when a logged-in user visit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:04.889Z. Updated 2026-04-07T14:03:51.327Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record

HighPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25253

KYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity Injection

KYOCERA Net Admin 3.4.0906 contains an XML External Entity (XXE) injection vulnerability in the Multi-Set Template Editor that allows unauthenticated attackers to read arbitrary system files. Attackers can craft a malicious XML file with external entity references to retrieve sensitive configuration data like database …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:04.490Z. Updated 2025-12-24T20:21:56.818Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:21 WIB

Official record

MedPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25252

Teradek VidiU Pro 3.0.3 Cross-Site Request Forgery via Password Change

Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft malicious web pages that automatically submit password change requests to the device when a logged-in administrator visits the page.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:04.078Z. Updated 2026-03-05T12:02:19.128Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record

MedPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25251

Teradek VidiU Pro 3.0.3 Server-Side Request Forgery via RTMP Settings

Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters 'url' and 'xml_url'. Attackers can exploit this flaw to bypass firewalls, initiate network enumeration, and potentially trigger external HTTP requests to arbitrary …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:03.642Z. Updated 2026-07-15T01:23:43.619Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

MedPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25250

Devolo dLAN 500 AV Wireless+ 3.1.0-1 Cross-Site Request Forgery

Devolo dLAN 500 AV Wireless+ 3.1.0-1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages that trigger unauthorized configuration changes by exploiting predictable URL actions when a logged-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:03.241Z. Updated 2025-12-24T20:22:20.223Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:22 WIB

Official record